What is the CVSS score of CVE-2025-65337?

CVE-2025-65337 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Fantastic Blog CMS CVE-2025-65337

EUVD-2025-210531 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-29 mitre

GHSA-4fp8-54c6-53mc

PHP XSS N A

6.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L assessed instead of PR:N because pageEditMember.php implies authentication is required; AV:N, S:C, and C:L/I:L consistent with standard stored/reflected XSS impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:26 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

6.1 (MEDIUM)

CVE Published

Jul 29, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field.

AnalysisAI

Reflected or stored cross-site scripting in Sourcecodester Fantastic Blog CMS 1.0 allows network-accessible attackers to inject malicious scripts via the address field in pageEditMember.php, executing arbitrary JavaScript in a victim's browser session. The Changed scope (S:C) in the CVSS vector confirms the injected script escapes the page context and can affect the victim's broader browser environment, enabling session hijacking or credential theft. EPSS stands at 0.14% (4th percentile), and no CISA KEV listing exists, though exploit documentation is publicly available via the TaintRadar research repository on GitHub.

Technical ContextAI

Fantastic Blog CMS 1.0 is a PHP-based blogging platform distributed via Sourcecodester, a site hosting educational and tutorial-grade web applications. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the root cause: user-supplied input to the address field in pageEditMember.php is rendered into HTML output without adequate encoding or sanitization. The S:C CVSS scope change is characteristic of XSS - the injected script runs in the victim's browser under the application's origin, potentially accessing cookies, session tokens, and local storage belonging to that origin. The CPE data returned as 'n/a:n/a' reflects that no formal CPE entry exists for this product in the NVD dictionary, limiting automated scanner detection.

RemediationAI

No vendor-released patch has been identified at time of analysis. The vendor, Sourcecodester, does not maintain a formal security advisory process typical of commercial software. As a primary compensating control, operators should apply output encoding to all user-supplied fields rendered in HTML - specifically, apply htmlspecialchars() with ENT_QUOTES in PHP for the address field before rendering in pageEditMember.php. Additionally, implement Content Security Policy (CSP) headers to restrict inline script execution, reducing XSS impact even if injection succeeds; note that CSP configuration complexity can introduce its own maintenance burden. If the pageEditMember.php endpoint is publicly accessible without authentication (as the PR:N CVSS metric suggests), restricting access to authenticated users is an independent and critical fix. Given the educational nature of this software, the most effective remediation for production operators is to replace this application with a maintained alternative.